CreepyDrive

MITRE ATT&CK: S1023 View on attack.mitre.org

Aliases: CreepyDrive

First seen
2022-01-01 00:00:00
Malware type
backdoor
Family
Malware family
Operating systems
windows, office-suite
Profile updated
2026-07-07 13:01:28

Targeted industries: energy-and-utilities government-and-public-sector

Targeted regions: country_code:il

Context

CreepyDrive is a custom implant has been used by POLONIUM since at least early 2022 for C2 with and exfiltration to actor-controlled OneDrive accounts. POLONIUM has used a similar implant called CreepyBox that relies on actor-controlled DropBox accounts.

Detection coverage

  • 1 YARA rules
  • 334 Sigma rules

Malware & tools used

  • Web Protocols (attack-pattern)
  • Exfiltration to Cloud Storage (attack-pattern)
  • Bidirectional Communication (attack-pattern)
  • Application Access Token (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • PowerShell (attack-pattern)
  • Data from Local System (attack-pattern)

Used by threat actors

Detection rules

  • SEKOIA_Apt_Polonium_Powershell_Creepydrive_Strings (yara-rule)

Reports & references

  • Microsoft — Exposing Polonium Activity And Infrastructure Targeting Israeli Organizations (report)
  • MITRE ATT&CK — S1023 (report)

External references